@tangle-network/sandbox 0.9.4-develop.20260701061438.a81baba → 0.9.4-develop.20260702071701.d493d16

package/README.md

@@ -75,6 +75,7 @@ try {
 }
 ```
 
+The detached lease includes `billing.seconds`, `billing.customerCostUsd`, and provider cost basis fields once billing is finalized.
 See `examples/gpu-eval-lease.ts` for the full create, run, detach, and sandbox cleanup flow.
 
 ## Installation

package/dist/auth/index.js

@@ -1,39 +1,78 @@
-import { createHmac, timingSafeEqual } from "node:crypto";
 //#region src/auth/tokens.ts
+const textEncoder = new TextEncoder();
+const textDecoder = new TextDecoder();
 /**
-* JWT Token Utilities
-*
-* Token generation and verification using HMAC-SHA256. Server-only
-* (uses Node.js `crypto`).
-*/
-/**
-* Base64URL encode (RFC 7515).
+* Base64URL encode (RFC 7515). Isomorphic: `btoa` + `TextEncoder` exist in
+* Node and browsers, so — unlike `Buffer` — this never blanks a browser page
+* that transitively imports the module.
 */
 function base64UrlEncode(data) {
-	return (typeof data === "string" ? Buffer.from(data) : data).toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+	const bytes = typeof data === "string" ? textEncoder.encode(data) : data;
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 /**
-* Base64URL decode (RFC 7515) to raw bytes. Returns `null` if the
-* input contains characters outside the base64url alphabet.
+* Base64URL decode (RFC 7515) to raw bytes. Returns `null` if the input is
+* not valid base64url (characters outside the alphabet, or a length that
+* cannot decode).
 */
-function decodeBase64UrlToBuffer(input) {
+function decodeBase64UrlToBytes(input) {
 	if (!/^[A-Za-z0-9_-]*$/.test(input)) return null;
 	const padded = input + "=".repeat((4 - input.length % 4) % 4);
-	return Buffer.from(padded.replace(/-/g, "+").replace(/_/g, "/"), "base64");
+	let binary;
+	try {
+		binary = atob(padded.replace(/-/g, "+").replace(/_/g, "/"));
+	} catch {
+		return null;
+	}
+	const bytes = new Uint8Array(binary.length);
+	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+	return bytes;
+}
+/**
+* Base64URL decode to a UTF-8 string, or `null` if the input is not valid
+* base64url.
+*/
+function decodeBase64UrlToString(input) {
+	const bytes = decodeBase64UrlToBytes(input);
+	return bytes === null ? null : textDecoder.decode(bytes);
+}
+let nodeCrypto;
+/**
+* Resolve Node's `crypto` lazily and synchronously. Signing and verification
+* are server-only (HMAC-SHA256), but this module must stay importable in a
+* browser bundle — a static `import "node:crypto"` forces bundlers to resolve
+* the builtin at load and blanks the page. `process.getBuiltinModule` exists
+* only on a Node runtime (Node >= 22.3); in a browser `globalThis.process` is
+* undefined, so callers get a clear server-only error instead of a crash.
+*/
+function getNodeCrypto() {
+	if (nodeCrypto) return nodeCrypto;
+	const resolved = globalThis.process?.getBuiltinModule?.("node:crypto");
+	if (!resolved) throw new Error("@tangle-network/sandbox/auth: token signing and verification are server-only (HMAC-SHA256 via Node.js crypto) and cannot run in a browser.");
+	nodeCrypto = resolved;
+	return nodeCrypto;
 }
 /**
 * Create HMAC-SHA256 signature.
 */
 function createSignature(data, secret) {
+	const { createHmac } = getNodeCrypto();
 	return base64UrlEncode(createHmac("sha256", secret).update(data).digest());
 }
 /**
-* JWT header (always the same for our use case).
+* Base64URL-encoded JWT header `{"alg":"HS256","typ":"JWT"}`. Computed on
+* first use (not at module load) and memoized.
 */
-const JWT_HEADER = base64UrlEncode(JSON.stringify({
-	alg: "HS256",
-	typ: "JWT"
-}));
+let jwtHeaderCache;
+function jwtHeader() {
+	if (jwtHeaderCache === void 0) jwtHeaderCache = base64UrlEncode(JSON.stringify({
+		alg: "HS256",
+		typ: "JWT"
+	}));
+	return jwtHeaderCache;
+}
 function issueToken(signingSecret, payload, ttlMinutes) {
 	const now = Math.floor(Date.now() / 1e3);
 	const fullPayload = {
@@ -41,7 +80,8 @@ function issueToken(signingSecret, payload, ttlMinutes) {
 		iat: now,
 		exp: now + ttlMinutes * 60
 	};
-	const data = `${JWT_HEADER}.${base64UrlEncode(JSON.stringify(fullPayload))}`;
+	const encodedPayload = base64UrlEncode(JSON.stringify(fullPayload));
+	const data = `${jwtHeader()}.${encodedPayload}`;
 	return `${data}.${createSignature(data, signingSecret)}`;
 }
 /**
@@ -119,8 +159,8 @@ function unsafeDecodeToken(token) {
 		if (parts.length !== 3) return null;
 		const payload = parts[1];
 		if (payload === void 0) return null;
-		const padded = payload + "=".repeat((4 - payload.length % 4) % 4);
-		const decoded = Buffer.from(padded.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString();
+		const decoded = decodeBase64UrlToString(payload);
+		if (decoded === null) return null;
 		return JSON.parse(decoded);
 	} catch {
 		return null;
@@ -145,20 +185,21 @@ function verifyToken(token, signingSecret, options = {}) {
 		if (parts.length !== 3) return null;
 		const [headerB64, payloadB64, signatureB64] = parts;
 		if (!headerB64 || !payloadB64 || !signatureB64) return null;
+		const headerJson = decodeBase64UrlToString(headerB64);
+		if (headerJson === null) return null;
 		let header;
 		try {
-			const headerPadded = headerB64 + "=".repeat((4 - headerB64.length % 4) % 4);
-			const headerJson = Buffer.from(headerPadded.replace(/-/g, "+").replace(/_/g, "/"), "base64").toString();
 			header = JSON.parse(headerJson);
 		} catch {
 			return null;
 		}
 		if (header.alg !== "HS256") return null;
 		const expectedSig = createSignature(`${headerB64}.${payloadB64}`, signingSecret);
-		const providedRaw = decodeBase64UrlToBuffer(signatureB64);
-		const expectedRaw = decodeBase64UrlToBuffer(expectedSig);
+		const providedRaw = decodeBase64UrlToBytes(signatureB64);
+		const expectedRaw = decodeBase64UrlToBytes(expectedSig);
 		if (!providedRaw || !expectedRaw) return null;
 		if (providedRaw.length !== expectedRaw.length) return null;
+		const { timingSafeEqual } = getNodeCrypto();
 		if (!timingSafeEqual(providedRaw, expectedRaw)) return null;
 		const payload = unsafeDecodeToken(token);
 		if (!payload) return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tangle-network/sandbox",
-  "version": "0.9.4-develop.20260701061438.a81baba",
+  "version": "0.9.4-develop.20260702071701.d493d16",
   "description": "Client SDK for the Tangle Sandbox platform - build AI agent applications with dev containers",
   "type": "module",
   "main": "./dist/index.js",
@@ -82,7 +82,7 @@
     "url": "https://github.com/tangle-network/agent-dev-container/issues"
   },
   "dependencies": {
-    "@tangle-network/agent-core": "^0.3.3",
+    "@tangle-network/agent-core": "^0.4.0",
     "@tangle-network/agent-interface": "^0.13.0"
   },
   "peerDependencies": {